Privacy Policy

1. Introduction

Bedrock Enterprises Ltd. ("Bedrock", "we", "us", or "our") respects the privacy of individuals and recognizes the importance of protecting personal information.

This Privacy Policy explains how personal information is collected, used, disclosed, retained, and protected in connection with our website, professional services, business communications, and related activities.

The website currently includes a Client Area for authorized clients, public verification of selected document records, a contact form, and a page for viewing payment instructions for an issued invoice. The website does not collect card payments or move funds.

Our areas of focus include audit and assurance, digital asset verification, reserve-related engagements, insurance and risk solutions, and advisory services.

We aim to handle personal information in a manner consistent with applicable Canadian privacy legislation. For our activities in British Columbia, that may include the Personal Information Protection Act (British Columbia) and, where it applies, the Personal Information Protection and Electronic Documents Act (PIPEDA).

This Privacy Policy applies to visitors to our website, prospective clients, business contacts, and individuals interacting with Bedrock in a professional capacity. Additional privacy notices or contractual provisions may apply to particular services.

2. Personal Information We Collect

Depending on the nature of your interaction with Bedrock, we may collect the following categories of information.

Contact and Identification Information

This may include your name, business email address, telephone number, organization name, job title, and other contact details provided during business communications.

Business and Professional Information

We may receive information concerning your organization, professional responsibilities, requested services, business operations, or other matters relevant to an inquiry or engagement.

Information Provided Through Communications

When you contact us, we may collect the information included in your inquiry, correspondence, documents, and subsequent communications.

Website and Technical Information

When you access our website, technical information may be generated or processed through our hosting and security infrastructure. This may include an IP address or similar network address, browser and device information, the page requested, the time of access, and diagnostic or security records.

Client Area sign-in, document verification, the contact form, and Pay an Invoice use a Cloudflare Turnstile security check. The website sends the resulting check token to Cloudflare so the request can be confirmed. It does not use that check for advertising.

Client Area Information

For an authorized client account, we maintain the account details needed to identify the client and its authorized representatives, including names and email addresses supplied for that account. Sign-in uses a password. Where multi-factor authentication is enabled for the account, sign-in also uses a one-time code from an authenticator application or a recovery code.

A successful sign-in creates a session. The session cookie holds an identifier for that session. The server stores a hash of that identifier, and the password is not placed in the cookie. A session ends after 30 minutes without activity and, in any event, within 12 hours. Signing out ends it sooner. A separate short-lived cookie is used only while a multi-factor check is being completed.

Documents

The Client Area can show documents issued to the signed-in client, together with associated details such as a reference, category, dates, and status. The document file itself is available only to that authenticated client. It is not published through public verification.

Public verification, where an administrator has marked a document as publicly verifiable, shows the recorded reference, category, issuer, relevant dates, and status. A recipient name is shown only when an administrator has chosen to disclose it. The public result does not include the document file.

Invoices and Payment Instructions

For invoices issued to a client, we keep billing details such as the payer name, invoice number, amounts, currency, dates, status, and the payment instructions prepared for that invoice. Those instructions may describe a bank transfer, a cryptocurrency transfer, or both, including the account or wallet details, asset, network, and any stated amount or expiry entered for that invoice.

An authorized recipient can view those instructions in the Client Area. A person who has the invoice number and the payment access code can also view them on Pay an Invoice. That public result does not include the payer's name. The website stores a cryptographic hash of the access code and a salt, not the code itself. The code is not stored in a Bedrock cookie or placed in the page address. The website does not collect card numbers, execute the transfer, or mark an invoice paid when the instructions are viewed.

Payment status, including a record that funds were received, is entered by an authorized administrator after the payment has been verified. That record may include the amount, currency, date, payment reference, and the source used to confirm it.

Client and Engagement Information

Where professional services are provided, we may process information necessary for the agreed engagement, including business records, financial documents, transaction information, supporting evidence, and information concerning authorized representatives.

Some engagement materials may contain personal or confidential information about individuals other than the direct client.

We seek to collect only information reasonably necessary for identified and legitimate purposes.

3. How We Use Personal Information

We may use personal information for the following purposes:

• Responding to inquiries and business communications.
• Evaluating requests for professional services.
• Establishing and maintaining business relationships.
• Administering contractual and professional engagements.
• Reviewing information and documentation within an authorized engagement.
• Managing administrative, billing, and accounting activities.
• Providing the Client Area, including access to that client's documents and invoices.
• Authenticating clients and protecting sessions, including multi-factor authentication where enabled.
• Showing a publicly verifiable document record to someone who presents its reference.
• Showing payment instructions to someone who presents the invoice number and payment access code.
• Recording the result of a verified payment.
• Maintaining website functionality and security, including security checks and rate limits.
• Detecting and investigating unauthorized activity.
• Meeting applicable legal, regulatory, and professional obligations.
• Responding to lawful requests and protecting legitimate legal interests.

We do not use personal information for unrelated purposes without an appropriate legal basis or consent where required.

4. Consent and Collection Practices

Where required by applicable law, Bedrock obtains consent for the collection, use, or disclosure of personal information.

Consent may be provided directly or through other legally recognized means, depending on the information involved and the circumstances.

Individuals may withdraw consent where permitted by law, subject to legal, contractual, regulatory, or professional restrictions.

We may also collect, use, or disclose information without consent where authorized or required by applicable law.

5. Disclosure of Personal Information

Bedrock does not sell personal information.

We may disclose personal information where reasonably necessary to:

• Service providers supporting website hosting, business communications, technical operations, or authorized professional activities.
• Independent professional advisers or specialists involved in an authorized engagement.
• Regulatory authorities, courts, or other parties where disclosure is required or permitted by law.
• Other parties where disclosure has been appropriately authorized.

We seek to limit disclosures to information necessary for the relevant purpose and to use appropriate contractual or organizational safeguards where required.

6. Website Technologies and Cookies

Bedrock does not set its own cookies when a visitor only opens a public page. The Client Area sets two strictly necessary cookies, and only when a client signs in or is completing multi-factor authentication.

• __Host-bedrock_session maintains an authenticated client session and supports account security.
• __Host-bedrock_mfa temporarily supports multi-factor authentication during sign-in. It is limited to that check, which expires after five minutes.

On the production website, both cookies are Secure, HttpOnly, and SameSite=Lax, with no Domain attribute. They are used only for Client Area authentication. A session created under the earlier cookie names bedrock_session and bedrock_mfa remains readable until that session expires. Disabling these cookies in the browser will prevent Client Area sign-in from working. The private administration panel is not part of the public website and uses its own separate sign-in.

Client Area sign-in, Verify a Document, the contact form, and Pay an Invoice use Cloudflare Turnstile. The browser loads that check from Cloudflare. Our server then sends Cloudflare the resulting token and our verification secret, so Cloudflare can confirm that the check matches the page and action. The contents of the form are not included in that confirmation. Depending on Cloudflare's configuration, the check may set or read cookies on those pages. Those cookies are controlled by Cloudflare. Bedrock uses the check to protect the forms, not for advertising. Cloudflare's own privacy practices govern its processing.

Repeated attempts to sign in, verify a document, send a contact message, or retrieve payment instructions are rate limited. The address used for that limit is held in server memory only for the short operational window needed to apply the limit. It is not kept as a permanent customer profile.

The website may record a limited security report when a browser reports a content-security violation. Those reports are reduced to a fixed description of the blocked content and the page path. They are not used to build an advertising profile, and their volume is limited.

Bedrock does not use its own advertising or analytics cookies. If Bedrock introduces such technologies, we will review the applicable transparency and consent requirements and update this Privacy Policy.

7. Data Storage and International Processing

Personal information may be processed by Bedrock and authorized service providers in locations determined by the relevant service arrangements.

Where information is processed outside an individual's province or country, different privacy and data-access laws may apply.

We consider applicable legal requirements and appropriate safeguards when selecting service providers and handling cross-border information.

Specific hosting and processing locations depend on the infrastructure and service providers actually used.

8. Information Security

Bedrock recognizes the importance of protecting information against unauthorized access, disclosure, alteration, loss, and misuse.

Security measures should be appropriate to the sensitivity of the information and the nature of the relevant activities. The measures in use include access restrictions, Client Area authentication, multi-factor authentication where enabled for an account, rate limits, and the security check described above. On the server, passwords, session identifiers, and payment access codes are stored in a protected form rather than as the original secret. These measures do not make every record encrypted, anonymized, or impossible to compromise.

No electronic system or method of transmission can be guaranteed to be entirely secure.

Information security practices are subject to periodic review and improvement as the company's systems and services develop.

9. Retention of Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, contractual, accounting, and professional requirements.

Retention periods may vary depending on the category of information, the nature of the engagement, and relevant recordkeeping obligations.

When information is no longer required, we seek to dispose of it using a method appropriate to its sensitivity. We do not represent that every former record is anonymized by a particular technique.

10. Access, Correction, and Privacy Requests

Subject to applicable law and permitted exceptions, individuals may request access to personal information held about them and request corrections where information is inaccurate or incomplete.

Individuals may also inquire about our privacy practices, raise concerns, or request deletion of information where applicable law permits.

We may require reasonable identity verification before processing certain requests to protect confidential information from unauthorized disclosure.

Requests will be evaluated and addressed in accordance with applicable legal requirements.

11. Confidential Client and Third-Party Information

Certain professional engagements may involve confidential financial, commercial, technical, or digital asset information.

Personal information received during an engagement is handled according to the applicable engagement terms, professional responsibilities, confidentiality obligations, and privacy requirements.

Information concerning third parties is not made publicly available merely because it is included in client-provided records. Public document verification and Pay an Invoice show only the limited fields described above. They do not publish the private document or invoice file.

Public blockchain information may be accessible independently of Bedrock, but its public availability does not automatically remove applicable obligations concerning personal information.

12. Third-Party Websites and Services

Our website may contain links to websites or services operated by third parties.

Bedrock is not responsible for the privacy practices or content of websites that we do not control.

Visitors should review the privacy notices of third-party services before providing personal information.

13. Children's Privacy

Our website and professional services are intended primarily for businesses and individuals acting in a professional capacity.

They are not directed to children.

We do not intentionally seek to collect personal information from children through the website. If we become aware of such collection, we will assess and address it in accordance with applicable law.

14. Privacy Incidents

If a privacy or security incident involving personal information occurs, Bedrock will assess the circumstances and take appropriate steps based on the nature of the incident and applicable legal obligations.

Where legally required, this may include notifying affected individuals, relevant authorities, or other parties.

15. Changes to This Privacy Policy

We may revise this Privacy Policy to reflect changes in our operations, services, technical infrastructure, or applicable legal requirements.

The updated version will be published on this page with a revised "Last Updated" date.

Material changes may require additional notice or consent where applicable law requires.

16. Contact and Privacy Inquiries

For questions about this Privacy Policy, requests concerning personal information, or privacy-related complaints, please contact:

BEDROCK ENTERPRISES LTD.
Registered Office
1916 Glen Gary Drive
Kamloops, BC V2E 1R4
Canada
[email protected]

This is the published business address and general email. It is not identified here as a designated statutory privacy officer. You may also use the Contact page.

Privacy requests should provide sufficient information to identify the nature of the inquiry without unnecessarily disclosing sensitive personal information.